[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does System and Network Security Acronyms and Abbreviations provide? (Part 5)

[Assistant]
ally found in an appendix) for definitions applicable to that particular document. The following conventions have been used in the preparation of the list of acronyms and abbreviations in this report.
-  Abbreviations and acronyms generally appear in all capital letters, although there are occasional exceptions-for example, meter (m) and decibels referenced to one milliwatt (dBm). -  Technical terms are not capitalized unless they are proper nouns. Names of people, places, and groups, and the titles of protocols, standards, and algorithms are considered proper nouns. For example, certification and accreditation (C&A) is not capitalized, but Advanced Encryption Standard (AES) is capitalized. -  Collective nouns are not capitalized (e.g., wide area network [WAN]). -  When two or more definitions of the same acronym or abbreviation are given, the acronym or abbreviation is italicized and repeated for each definition. Definitions are listed alphabetically. ## 2. Acronym and Abbreviation List

This section consists of a list of selected system and network security acronyms and abbreviations, along with their generally accepted definitions. When there are multiple definitions for a single term, the acronym or abbreviation is italicized and each definition is listed separately.

System and Network Security Acronyms and Abbreviations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 2)

[Assistant]
systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.
This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172 Natl. Inst. Stand. Technol. Spec. Publ. 800-172, 84 pages (February 2021)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions:

| Specification of χ ................................................................................................................15 | | | | 3.2.5 | Specification of ι.................................................................................................................15 | | | | 3.3 KECCAK- p [ b , n r ] ..............................................................................................................................16 | 3.3 KECCAK- p [ b , n r ] ..............................................................................................................................16 | | | | 3.4 COMPARISON WITH KECCAK- f .........................................................................................................17 | 3.4 COMPARISON WITH KECCAK- f .........................................................................................................17 | | | 4 | SPONGE CONSTRUCTION ............................................................................................................................17 | SPONGE CONSTRUCTION ............................................................................................................................17 | | | 5 | KECCAK.............................................................................................................................................................19 | KECCAK.............................................................................................................................................................19 | | | | 5.1 SPECIFICATION OF pad10*1 .............................................................................................................19 | 5.1 SPECIFICATION OF pad10*1 .............................................................................................................19 | | | | 5.2 SPECIFICATION OF KECCAK[ c ].........................................................................................................20 | 5.2 SPECIFICATION OF KECCAK[ c ].........................................................................................................20 | | | 6 | 6.1 SHA-3 HASH FUNCTIONS ................................................................................................................20 | 6.1 SHA-3 HASH FUNCTIONS ................................................................................................................20 | | | | 6.2 SHA-3 EXTENDABLE-OUTPUT FUNCTIONS .....................................................................................20 | 6.2 SHA-3 EXTENDABLE-OUTPUT FUNCTIONS .....................................................................................20 | | | | 6.3 ALTERNATE DEFINITIONS OF SHA-3 EXTENDABLE-OUTPUT FUNCTIONS .......................................21 | 6.3 ALTERNATE DEFINITIONS OF SHA-3 EXTENDABLE-OUTPUT FUNCTIONS .......................................21 | | | 7 | | | CONFORMANCE..............................................................................................................................................21 | | A | SECURITY.........................................................................................................................................................23 | SECURITY.........................................................................................................................................................23 | | | | A.1 SUMMARY........................................................................................................................................23 A.2 ADDITIONAL CONSIDERATION FOR EXTENDABLE-OUTPUT FUNCTIONS ..........................................24 | A.1 SUMMARY........................................................................................................................................23 A.2 ADDITIONAL CONSIDERATION FOR EXTENDABLE-OUTPUT FUNCTIONS ..........................................24 | |

SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface provide? (Part 5)

[Assistant]
ards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.
ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| 1. Introduction...................................................................................................................................1    |
|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Overview: Concepts and Constructs................................................................................................3                  |
| 2.3.1.

Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop provide? (Part 5)

[Assistant]
-------------------------------------------------------|
| 2                  | Workshop................................................................................................................
1 Summary and Key Takeaways..............................................................................4 |
|                    | 1.2 About the Cybersecurity Risks in Consumer Home IoT Devices Virtual                                                                                |
| 3                  | Next Steps ............................................................................................................11                                                                                |
|                    | References...................................................................................................................12                                                                                |
| List of Appendices | Appendix A-Poll Results .........................................................................................13                                                                                |
| A.1                | Ultimate Demand Driver for Security in Home IoT ........................................ 13                                                                                |
| A.2                | Willingness to Pay More for Security in Low-Cost IoT Devices..................... 14                                                                                |
| A.3                | Primary Responsibility for Home IoT Device Security...................................

Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guidelines on PDA Forensics:

## Guidelines on PDA Forensics

## Guidelines on PDA Forensics

Personal Digital Assistants (PDAs) are a relatively recent phenomenon, not usually covered in classical computer forensics.  This guide attempts to bridge that gap by providing an in-depth look  into  PDAs  and  explaining  the  technologies  involved  and  their  relationship  to  forensic procedures.  It covers three families of devices Pocket PC, Palm OS, and Linux-based PDAs -  and  the  characteristics  of  their  associated  operating  system.    This  guide  also  discusses procedures  for  the  preservation,  acquisition,  examination,  analysis,  and  reporting  of  digital information present on PDAs, as well as available forensic software tools that support those activities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Vetting the Security of Mobile Applications:

and therefore the simulation may not be completely accurate. Note that malware increasingly detects the use of emulators as a testing platform and changes its behavior accordingly to avoid detection.
Therefore, it is recommended that test tools use a combination of emulated and physical mobile devices to avoid falsenegatives from malware that employs anti-detection techniques.

Vetting the Security of Mobile Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT):

-  Connected vehicle IoT enables vehicles, roads, and other infrastructure to communicate and share vital transportation information. -  Consumer IoT consists of IoT applications in residences as well as wearable and mobile devices. -  Health IoT processes data derived from sources such as electronic health records and patient-generated health data. -  Smart building IoT includes energy usage monitoring systems, physical access control security systems and lighting control systems. -  Smart manufacturing IoT enables enterprise-wide integration of data, technology, advanced manufacturing capabilities, and cloud and other services. In the above examples, consent provides the core access control attribute needed to authorize disclosure and distribution of protected health information. Emerging healthcare security and messaging standards will enable information classification (labeling) that, with appropriate clearances, will provide interoperable security systems employing attribute-based access control (ABAC) methods. In the IoT, new models of computable healthcare trust may become commonplace. -  Restricting logical access to the network and network activity. This may include using unidirectional gateways, a demilitarized zone network architecture with firewalls to prevent network traffic from passing directly between the corporate and IoT networks, and having separate authentication mechanisms and credentials for users of the corporate and IoT networks. An IoT system should use a network topology that has multiple layers, with each layer's security considered separately, so that all communication occurs with as much security and reliability as afforded by the technology. -  Restricting physical access to IoT network and components. Unauthorized physical access to components could cause serious disruption of an IoT system's functionality. A combination of physical access controls should be used, such as locks, card readers, and/or guards.

Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations:

| Cryptographic keying relationship          | Two or more entities share the same symmetric key. |
|--------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Cryptographic Key Management System (CKMS) | The framework and services that provide for the generation, production, establishment, control, accounting, and destruction of cryptographic keys It includes all elements (policies, procedures, devices, and components); facilities; personnel; procedures; standards; and information products that form the system that establishes, manages, and supports cryptographic products and services for end entities. The CKMS may handle symmetric keys, asymmetric keys or both. |
| Cryptographic mechanism                    | An element of a cryptographic application, process, module or device that provides a cryptographic service, such as confidentiality, integrity, source authentication, and access control (e.g., encryption and decryption, and digital signature generation and verification). |
| Cryptographic module                       | The set of hardware, software, and/or firmware that implements approved cryptographic functions (including key generation) that are contained within the cryptographic boundary of the module. |
| Cryptographic product                      | Software, hardware or firmware that includes one or more cryptographic functions. Acryptographic product is or contains a cryptographic module.

Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts  and  methodologies,  may  be  used  by  Federal  agencies  even  before  the  completion  of  such companion publications. Thus, until each publication is completed, current requirements, guidelines, and  procedures,  where  they  exist,  remain  operative.  For  planning  and  transition  purposes,  Federal agencies may wish to closely follow the development of these new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing technical  leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL develops  tests,  test  methods,  reference  data,  proof  of  concept  implementations,  and technical  analyses  to  advance  the  development  and  productive  use  of  information technology. ITL's responsibilities include the development of management, administrative,  technical,  and  physical  standards  and  guidelines  for  the  cost-effective security  and  privacy  of  other  than  national  security-related  information  in  Federal information  systems.  The  Special  Publication  800-series  reports  on  ITL's  research, guidelines,  and  outreach  efforts  in  information  system  security,  and  its  collaborative activities with industry, government, and academic organizations.

29  Draft SP 800-118, Guide to Enterprise Password Management , is currently under development [SP 800118].

Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile:

3.2.3. 3.2.3.

Cybersecurity Framework Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.6 (NIST 3.4.6)?

[Assistant]
According to Guide to SSL VPNs:

3.4.6 Client Software Selection

Although SSL VPNs are described as clientless, some forms of SSL VPN access such as network extension require dynamically downloaded agents to be run on the host.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Recommendation for Cryptographic Key Generation:

|                     | pair itself or a trusted party generated the key pair for the entity. 2. For a symmetric key (i.e., a secret key), the entity or entities that are authorized to share and use the key. |
|---------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Parameter           | Avalue that is used to control the operation of a function or that is used by a function to compute one or more outputs. |
| Party               | See Entity. |
| Password            | A string of characters (letters, numbers, and other symbols) that are used to authenticate an identity or to verify access authorization. A passphrase is a special case of a password that is a sequence of words or other text. In this Recommendation, the use of the term 'password' includes this special case. |
| Permutation         | An ordered (re)arrangement of the elements of a (finite) set; a function that is both a one-to-one and onto mapping of a set to itself. |
| Plaintext data      | In this Recommendation, data that will be encrypted by an encryption algorithm or obtained from ciphertext using a decryption algorithm. |
| Pre-shared key      | A secret key that has been established between the parties who are authorized to use it by means of some secure method (e.g., using a secure manual-distribution process or automated key-establishment scheme).

Recommendation for Cryptographic Key Generation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.12 (NIST 3.2.12)?

[Assistant]
According to Research Report_ User Perceptions of Smart Home Privacy and Security:

3.2.12                                                   | Risk Acceptance                                          | 20              |
| 3. 3.2.12 Risk Acceptance

Although some participants had concerns, they ultimately made a conscious choice, described as 'willful ignorance' by P1\_A, to accept privacy and security risks in exchange for perceived benefits.

Research Report_ User Perceptions of Smart Home Privacy and Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Identification and Authentication?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The predominant application architecture for cloud-native applications consists of multiple microservices, accompanied in some instances by a centralized application infrastructure, such as a service mesh, that provides all application services. This class of applications is generally developed using a flexible and agile software development paradigm called DevSecOps. A salient feature of this paradigm is the use of flow processes called continuous integration and continuous deployment (CI/CD) pipelines, which initially take the software through various stages (e.g., build, test, package, and deploy) in the form of source code through operations that constitute the software supply chain (SSC) in order to deliver a new version of software . This document outlines strategies for integrating SSC security measures into CI/CD pipelines.

actor; artifact; attestation; CI/CD pipeline; package; provenance; repository; SBOM; SDLC; SLSA; software supply chain.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Cryptographic Algorithms and Key Sizes for Personal Identity Verification:

Specification of Digital Signatures on Authentication Information..........................................7                                                                                | 3.2.1. Specification of Digital Signatures on Authentication Information..........................................7                                                                                |                                                                                |
|                                                                                | 3.2.2. Specification of Public Keys In X.509 Certificates .....................................................................8                                                                                | 3.2.2. Specification of Public Keys In X.509 Certificates .....................................................................8                                                                                |                                                                                |
|                                                                                | 3.2.3.

Cryptographic Algorithms and Key Sizes for Personal Identity Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 3)

[Assistant]
efore  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96]. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Reports on Computer Systems Technology

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters:

3.2.2                                                                                | 3. 3.2.2  Voter Authentication

State law will determine appropriate authentication mechanisms for accepting voter registration materials, blank ballot requests, and returned marked ballots.

Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Glossary of Computer Security Terminology provide? (Part 2)

[Assistant]
ic dissemination of this federally sponsored work. This publication is part of a continuing effort to assist federal agencies in accordance with NIST's mandate under the Computer Security Act of 1987.
NIST expresses its appreciation to the Subcommittee on Information Systems Security (SISS) and the Executive Secretariat of the National Security Telecommunications and Information Systems Security Committee for their kind permission to publish this report. We also wish to acknowledge the many computer security professionals who participated in the development of this glossary. Questions regarding this publication should be addressed to the Associate Director for Computer Security, Computer Systems Laboratory, Building 225, Room B154, National Institute of Standards and Technology, Gaithersburg, MD, 20899. Additional copies of this publication may be purchased through the National Technical Information Service, Springfield, VA, 22161, telephone: (703) 487-4650. ## Glossary of Computer Security Terminology

## -A-

| aborted connection       | Disconnection which does not follow established procedures. This may occasionally result from a bad phone connection, but more typically results when the user "hangs up" without attempting to issue the disconnect commands. Note: Some systems are sensitiue to aborted connections, and do not detect the disconnect and reset for the next user. Continued aborts are considered [improper], and may result in a warning or revocation of access privileges.

Glossary of Computer Security Terminology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report):

| . | . | . . | III-17        |
| III-13        | Physical/Environmental Protection-GADPS                                    |                                    | . | . | .
| III-17        |
| III-14        | Controls-GADPS                                                             |                                    |        |      |      | III-17        |
| III-15        | Production, I/O Emergency, Backup, and Cont. Planning-GADPS                |                                    |        |      |      | III-18        |
| III-16        | Software and Maintenance-GADPS                                             | . | . | . | . | III-18        |
| III-17        | System Security Awareness and Training-GADPS                               | . | . | . | . | III-18        |
| III-18 III-19 | Authorization and Access Controls-GADPS Audit Trail Mechanisms-GADPS       |                                    | . . | . . | . . | III-19 III-19 |
| III-20        | Confidentiality Controls-GADPS                                             |                                    |        |      |      | III-19        |
| III-21        | Integrity Controls-GADPS                                                   |                                    |        |      |      | III-20        |
| III-22        | User                                                                       | Identification/Authorization-GADPS | . | . | . | III-20        |
| III-23        | Assignment Security Responsibility-MAS                                     |                                    |        | . | . | III-22        |
| III-24        | Personnel Screening-MAS . | . |        | . | .

1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Application Whitelisting provide? (Part 3)

[Assistant]
blic comment periods and provide feedback to  NIST. All  NIST  Computer  Security  Division  publications,  other  than  the  ones  noted  above,  are  available  at http://csrc.nist.gov/publications.
## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Abstract

An application whitelist is a list of applications and application components that are authorized for use in an organization. Application whitelisting technologies use whitelists to control which applications are permitted to execute on a host. This helps to stop the execution of malware, unlicensed software, and other unauthorized software. This publication is intended to assist organizations in understanding the basics of application whitelisting. It also explains planning and implementation for whitelisting technologies throughout the security deployment lifecycle.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Understanding Stablecoin Technology and Related Security Considerations:

All such issued stablecoins are over-collateralized, which promotes the maintenance of the stablecoin peg since stablecoins can always be redeemed from the issuer at their pegged price. The price is further stabilized through arbitrage. If the price of the stablecoin on third-party markets falls below its peg, then borrowers of the stablecoin can purchase the stablecoin at a discount price and use it to pay off their debt positions (making a profit). When debt positions are paid off, the provided stablecoins are burned. This reduces the overall supply, which puts an upward pressure on the price. If the price of the stablecoin on third-party markets rises above its peg, then borrowers will take on additional debt positions, which results in the minting of additional stablecoins. The borrowers can then immediately sell the newly minted stablecoins on third-party markets for a profit. This increases the overall supply, which puts a downward pressure on the price. The cryptocurrency-backed stablecoins minted through loan issuance (Section 4.2) require users to post cryptocurrency as collateral when borrowing. This mitigates the cryptocurrency losing its price peg since enough collateral should be maintained to cover all issued stablecoins. However, since the posted collateral is in the form of cryptocurrency, it may be extremely volatile. Thus, borrowers are required to over-collateralize. When borrowing, the stablecoin system will specify a minimum required collateral ratio. That is, the user must maintain a certain value of cryptocurrency collateral to cover the price of the borrowed stablecoins. If the user falls below that ratio (through the posted cryptocurrency losing value), then the user is required to post more collateral, or their collateral may be subject to liquidation. This is very similar to the maintenance of margin loans in the stock market. Margin investors in the stock market may be required to post additional collateral to cover stock market loses.

Understanding Stablecoin Technology and Related Security Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Incident Response?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2:

tions from SCAP 1.1: XCCDF from 1.1.4 to 1.2; OVAL from 5.8 to 5.10; and CPE from 2.2 to 2.3. Added and revised requirements throughout the specification to use these component specification versions.
-  In Section 2, rewrote the conformance requirements and defined 'content producer' and 'content consumer' terms. -  Section 3:
- o Added an SCAP source data stream subsection and a subsection on digitally signing source data stream content. - o Added identifier use requirements for <xccdf:Rule> and <xccdf:ident > elements. - o Added requirements for the <xccdf:Value> element. - o Added requirements related to Schematron rules. -  Section 4:
- o Revised legacy support requirements for SCAP content and OVAL definition documents. - o Added an SCAP result data stream subsection. Added source and result data stream requirements throughout the section. Also added a subsection on digitally signing result data stream content. - o Added a declaration of the FDCC Reporting Format. -  In Section 5, added malware detection material to the Inventory Scanning use case. -  Updated the normative references. -  Added Appendix C (change log).

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Minimum Security Requirements for Multi-User Operating Systems:

3.1.1                             | Identification                              | 3-1     |
|                                |                                | 3. 3.1.1 Identification

A userlD represents a user uniquely.

Minimum Security Requirements for Multi-User Operating Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Computer Security Division 2011 Annual Report:

| Research in Emerging Technologies ..........................................34                                                                    |                                                                    |
|---------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------|
| Automated Combinatorial Testing for Software .................................. | 34                                                                 |
| Cloud Computing and Virtualization................................................ | 35                                                                 |
| Security Ontologies for Risk Assessment........................................... | 36                                                                 |
| Mobile Device Security                                                                                | ............................................................... 36 |
| Access Control and Privilege Management                                                                                | .................................37                                |
| Access Control and Privilege Management Research............................. | 37                                                                 |
| Conformance Verification for Access Control Policies ........................... | 38                                                                 |
| Metrics for Evaluation of Access Control Systems................................ | 38                                                                 |
| Policy Machine .........................................................................

Computer Security Division 2011 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN):

| 1 | | | Scope..............................................................................................................................2 | | | | Audience | .........................................................................................................................5 | | Intended Use..........................................................................................................................6 | Intended Use..........................................................................................................................6 | Intended Use..........................................................................................................................6 | | | Overview ................................................................................................................................7 | Overview ................................................................................................................................7 | | | Risk Management Overview...........................................................................................

Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Attribute-based Access Control for Microservices-based Applications using a Service Mesh:

- Multiple, loosely coupled microservices communicate through network calls, and these communication links must be protected. In the case of monolithic applications, these communications take place through procedure calls.
- The entire network and all microservices are untrusted. Therefore, mutual authentication and secure communication channels between microservices through mechanisms such as mutual Transport Layer Security (TLS) (mTLS) are required.
- The logging data that pertains to each microservice must be consolidated to obtain a security profile in order for forensics, audits, and analytics to assess the overall health of the application.

- The proxies (e.g., Ingress, sidecar, and Egress) play the role of PEPs since they intercept all requests that emanate from each client, user, service, or external service.
- The PEPs enforce access control policies by performing the allow/deny actions based on the verdict provided by PDP.
- The enforcement function can be provided either natively (using local configuration structures, such as Access Control Lists [ACLs]) or using proxy extensions that call an external authorization server to obtain one or more of the data in the previous bullet.
- The assurance mechanisms in the service mesh (e.g., certificate-based authentication, secure session, non-bypassability, execution isolation) can be leveraged to deploy a high assurance authorization framework. Execution isolation is running each software component in a contained environment or sandbox-leveraging hardware virtualization that limits the damage of malware, limits the speed and propagation of worms and viruses, and efficiently detects attacks.

Attribute-based Access Control for Microservices-based Applications using a Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN) provide? (Part 5)

[Assistant]
publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.
## Table of Contents

|                                                                                | Introduction ...........................................................................................................................1   | Introduction ...........................................................................................................................1   |
|-----------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Purpose and Objectives..................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Digital Identity Guidelines_ Federation and Assertions:

|
|                                                                                | 2.4. | Federation Assurance Level 3 (FAL3) . . . . . . . . . . . . . . . . . . . . 7         |
| 2.5.
| Requesting and Processing xALs . . . | . . . . . . . . . . . . . . . . . . . 8                                               |
| 3. Common Federation Requirements . . . . . . . . . . . . . . . . . . . . . . . 10    | 3. Common Federation Requirements . . . . . . . . . . . . . . . . . . . . . . . 10    | 3. Common Federation Requirements . . . . . . . . . . . . . . . . . . . . . . . 10    |
| 3.1. |                                                                                | Federation Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11        |
| 3.2. |                                                                                | Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12      |
|                                                                                | 3.2.1. | Credential Service Provider (CSP) . . . . . . . . . . . . . . . . . 12                |
|                                                                                | 3.2.2. . . | Identity Provider (IdP) . . . . . . . . . . . . . . . . . . . . . 12                  |
|                                                                                | 3.2.3. | Relying Party (RP) . . . . . . . . . . . . . . . . . . . . . . . . . 13               |
| 3.3. | Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13      | Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13      |
|                                                                                | 3.3.1. | Trust Agreement Management . . . . . . . . . . . . . . . . . . 13                     |
|                                                                                | 3.3.2. .

Digital Identity Guidelines_ Federation and Assertions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Information Security Handbook_ A Guide for Managers:

| 1. Introduction .................................................................................................... | 1. Introduction .................................................................................................... | 1. Introduction .................................................................................................... | 1. Introduction ....................................................................................................

Information Security Handbook_ A Guide for Managers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN):

|                                                                                | Introduction ...........................................................................................................................1   | Introduction ...........................................................................................................................1   |
|-----------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Purpose and Objectives..................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Practical Combinatorial Testing:

| CONFIGURATION TESTING ....................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Approaches for Federal Agencies to Use the Cybersecurity Framework:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Agencies often track managed vulnerabilities, vulnerability mitigation plans, and accepted vulnerabilities on a system-by-system basis. This information is in the system Security Authorization Package, which includes the system security plan (SSP), the security assessment report (SAR), and the plan of action and milestones (POA&Ms).

Approaches for Federal Agencies to Use the Cybersecurity Framework


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities provide? (Part 5)

[Assistant] | Establishing a Test, Training, and Exercise Program | | | | | 2.1 | Develop Comprehensive TT&E Policy.....................................................................2-3 | | | | 2.2 | Identify TT&E Roles and Responsibilities ................................................................2-4 | | | | 2.3 2.4 | Establish Overall TT&E Schedule............................................................................2-4 Document TT&E Event Methodology.......................................................................2-4 | | | | 2.5 | Recommendations...................................................................................................2-5 | | | 3.

Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Discussion on the Full Entropy Assumption of the SP 800-90 Series provide? (Part 2)

[Assistant]
and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-03-30

## How to Cite this NIST Technical Series Publication:

Buller D, Kaufer A, Roginsky A, Sönmez Turan M (2023) Discussion on the Full Entropy Assumption of the SP 800-90 Series. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8427. https://doi.org/10.6028/NIST.IR.8427

## Author ORCID iDs

Roginsky, Allen: 0000-0003-2684-6736 Meltem Sönmez Turan: 0000-0002-1950-7130

## Submit Comments

rbg\_comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

The NIST Special Publication (SP) 800-90 series supports the generation of high-quality random bits  for  cryptographic  and  non-cryptographic  use. The  security  strength  of  a  random  number generator depends on the unpredictability of its outputs. This unpredictability can be measured in terms of entropy, which the NIST SP 800-90 series measures using min-entropy . A full-entropy bitstring has an amount of entropy equal to its length. Full-entropy bitstrings are important for cryptographic applications, as these bitstrings have ideal randomness properties and may be used for  any  cryptographic  purpose.

Discussion on the Full Entropy Assumption of the SP 800-90 Series


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Practical Combinatorial Testing:

| 1 INTRODUCTION .........................................................................................2 | 1 INTRODUCTION .........................................................................................2 | 1 INTRODUCTION .........................................................................................2 | | |-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------| | 1.1 | 1.1 | Authority..............................................................................................................2 | | | 1.2 | 1.2 | Document Scope and Purpose | .............................................................................2 | | 1.3 | 1.3 | Audience and Assumptions..................................................................................3 | | | 1.4 | 1.4 | Organization: How to use this Document...........................................................3 | | | 2 COMBINATORIAL METHODSIN TESTING.................................................4 | 2 COMBINATORIAL METHODSIN TESTING.................................................4 | 2 COMBINATORIAL METHODSIN TESTING.................................................4 | | | 2.1 | 2.1 | Two Forms of Combinatorial Testing..................................................................6 | | | 2.2 | 2.2 | The Test Oracle Problem | .....................................................................................9 | | 2.3 | 2.3 | Chapter Summary | ..............................................................................................10 | | 3 | CONFIGURATION TESTING ....................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guidelines for the Secure Deployment of IPv6:

Another limitation of IPv4 is that its design favored interoperability over security and did not contain features that protected the confidentiality, integrity, or availability of communications. For example, IPv4 could not cryptographically protect data from eavesdropping or manipulation, and IPv4 did not provide a method for endpoints to authenticate each other. Over time, the open nature of IPv4 was increasingly a target of exploitation. The multi-path nature of the Internet, which was designed for high availability, also allows multiple attack vectors for a variety of threats. As a response, new technologies were added to IPv4 to provide needed security functionality. With IPv6, these features were designed into the new protocol as mandatory components. IP security (IPsec) is a suite of protocols for securing Internet Protocol (IP) communications by authenticating the sender and providing integrity protection plus optionally confidentiality for the transmitted data. This is accomplished through the use of two extension headers: the Encapsulating Security Payload (ESP) and the Authentication Header (AH). The negotiation and management of IPsec security protections and the associated secret keys is handled by the Internet Key Exchange (IKE) protocol. IPsec is a mandatory part of an IPv6 implementation; however, its use is not required. IPsec is also specified for securing particular IPv6 protocols (e.g., Mobile IPv6 and OSPFv3 [Open Shortest Path First version 3]). Section 5.3 describes IPsec in detail. -  Routing Header . NH value of 43 in the immediately preceding header. The Routing Header is used by an IPv6 source (sending host) to list one or more intermediate nodes to be traversed on the way to a packet's destination. The sending host sets the NH extension to direct a packet through a certain path. In IPv4, this is called the Loose Source and Record Route option.

Guidelines for the Secure Deployment of IPv6


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Prioritizing Cybersecurity Risk for Enterprise Risk Management:

| Executive Summary............................................................................................................................1             |
|------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................4        |
| 2. Cybersecurity Risk Considerations ..................................................................................................9                   |
| 2.2.1. Factors Influencing Prioritization ................................................................................................12               |
| 2.2.2. Cybersecurity Risk Optimization .................................................................................................12                 |
| 2.2.3. Cybersecurity Risk Priorities at Each Enterprise Level................................................................14                            |
| 2.2.4. Considerations of Positive Risks as an Input to ERM..................................................................15                             |
| 2.2.5. Visualizing Risk Priority ...............................................................................................................16         |
| 2.3.1. Risk Acceptance...........................................................................................................................21        |
| 2.3.2. Risk Avoidance ............................................................................................................................22       |
| 2.3.3. Risk Transfer................................................................................................................................22     |
| 2.3.4.

Prioritizing Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-07-25

## How to Cite this NIST Technical Series Publication

Booth H, Souppaya M, Vassilev A, Ogata M, Stanley M, Scarfone K (2024) Secure Development Practices for Generative AI and Dual-Use Foundation AI Models: An SSDF Community Profile. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-218A. https://doi.org/10.6028/NIST.SP.800-218A

## Author ORCID iDs

Harold Booth: 0000-0003-0373-6219 Murugiah Souppaya: 0000-0002-8055-8527 Apostol Vassilev: 0000-0002-9081-3042 Michael Ogata: 0000-0002-8457-2430 Karen Scarfone: 0000-0001-6334-9486

## Contact Information

ssdf@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/218/a/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

This document augments the secure software development practices and tasks defined in Secure Software Development Framework (SSDF) version 1.1 by adding practices, tasks, recommendations, considerations, notes, and informative references that are specific to AI model development throughout the software development life cycle.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Module-Lattice-Based Digital Signature Standard:

1. Name of Standard. Module-Lattice-Based Digital Signature Standard (FIPS 204). 2. Category of Standard. Computer Security. Subcategory. Cryptography. 3. Explanation. This standard specifies ML-DSA, a lattice-based digital signature algorithm for applications that require a digital signature rather than a written signature. Additional digital signature schemes are specified and approved in other NIST Special Publications and FIPS publications (e.g., FIPS 186-5 [1]). A digital signature is represented in a computer as a string of bits and computed using a set of rules and parameters that allow the identity of the signatory and the integrity of the data to be verified. Digital signatures may be generated on both stored and transmitted data. 7. Applications. A digital signature algorithm allows an entity to authenticate the integrity of signed data and the identity of the signatory. The recipient of a signed message can use a digital signature as evidence in demonstrating to a third party that the signature was, in fact, generated by the claimed signatory. This is known as non-repudiation since the signatory cannot easily repudiate the signature at a later time. A digital signature algorithm is intended for use in electronic mail, electronic funds transfer, electronic data interchange, software distribution, data storage, and other applications that require data integrity assurance and data origin authentication. 8. Implementations. A digital signature algorithm may be implemented in software, firmware, hardware, or any combination thereof. NIST will develop a validation program to test implementations for conformance to the algorithm in this standard. For every computational procedure that is specified in this standard, a conforming implementation may replace the given set of steps with any mathematically equivalent set of steps. In other words, different procedures that produce the correct output for every input are permitted.

Module-Lattice-Based Digital Signature Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guide to Protecting the Confidentiality of Personally Identifiable Information (PII):

The primary audience for this document is the individuals who apply policies and procedures for protecting the confidentiality of PII on Federal information systems, as well as technical and nontechnical personnel involved with implementing system-level changes concerning PII protection methods. Individuals in many roles should find this document useful, including chief privacy officers and other privacy officers, privacy advocates, privacy support staff, public affairs staff, compliance officers, human resources staff, system administrators, chief information security officers, information system security officers, information security support staff, computer security incident response teams, and chief information officers.

personnel when investigating incidents.  All access to the log occurs only from the organization's own systems.

Management of incidents involving PII often requires close coordination among personnel from across the organization, such as the CIO, CPO, system owner, data owner, legal counsel, and public relations officer.  Because of this need for close coordination, organizations should establish clear roles and responsibilities to ensure effective management when an incident occurs.

Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to U.S. Department of Justice Simplified Risk Analysis Guidelines:

- 3.3. Application Systems.
- a. Nonsensitive.
- (1) A management control process shall be established to assure that appropriate administrative, physical, and technical safeguards are incorporated into all new applications, and into significant modifications to existing applications.
- (2) The AIS shall control the capability to input, update, or change system data and restrict this capability to specified authorized individuals or groups
- (3) Security measures to validate data must be implemented.
- (4) All system users shall be uniquely identified and
- authenticated
- b. Sensitive. In addition to the requirements for nonsensitive application systems listed above, the minimum security requirements listed below for sensitive application systems must be met.
- (1) Security requirements and specifications must be defined and approved by the application system manager prior to acquiring or starting formal development of the application. Prior to placing the application in operation, design reviews and system tests shall be conducted to assure that the proposed design meets the security specifications.
- (2) Upon completion of the system tests, the application system manager must certify that the system meets all applicable Federal policies, regulations, and standards, and that the results of the tests demonstrate that the installed security safeguards are adequate for the application.
- (3) Contingency plans must be developed to assure that users can continue to perform essential functions in the event their data processing support is interrupted. The plans should be consistent with the contingency plans of the AIS installation that is processing the application.

U.S. Department of Justice Simplified Risk Analysis Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation:

-------------------------------------------------------------------------------------------------|
| [Murphy]     | S. Murphy, 'RPKI Tutorial: Routing Security and RPKI', NANOG on the Road (NOTR), St.
Louis, MO, November, 2015 https://www.nanog.org/sites/default/files/04-Murphy-StLouis.pdf                                                                                |
| [NABCOP]     | 'DDoS-DoS-attack-BCOP,' North American BCOP, http://nabcop.org/index.php/DDoS-DoS-attack-BCOP                                                                                |
| [Naik]       | A. Naik, 'Internet Vulnerability Takes Down Google,' ThousandEyes report, November 2018 . https://blog.thousandeyes.com/internet- vulnerability-takes-down-google/                                                                                |
| [NANOG]      | 'Practical BGP Origin Validation using RPKI: Vendor Support, Signing and Validation Services, and Operational Experience,' NANOG Track (multiple presentations) at NANOG 67, Chicago, IL, June 2016 . https://archive.nanog.org/meetings/nanog67/agenda                                                               |
| [NANOG-list] | 'Intra-AS messaging for route leak prevention,' NANOG Email List - Discussion Thread, June 2016. http://mailman.nanog.org/pipermail/nanog/2016-June/thread.html#86348                                                                                |
| [NCCoE-sidr] | W. Haag, D. Montgomery, W.C. Barker, A. Tan, 'Protecting the Integrity of Internet Routing: Border Gateway Protocol (BGP) Route Origin Validation, Volume B,' NIST Special Publication (SP) 1800-14B, August 2018.

Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to Computer Security Log Management:

checking software, run periodically instead of continuously, so they generate log entries in batches instead of on an ongoing basis. 4
- GLYPH<c=31,font=/APONEK+Webdings> Remote Access Software.
Remote access is often granted and secured through virtual private networking (VPN). VPN systems typically log successful and failed login attempts, as well as the dates and times each user connected and disconnected, and the amount of data sent and received in each user session. VPN systems that support granular access control, such as many Secure Sockets Layer (SSL) VPNs, may log detailed information about the use of resources. - GLYPH<c=31,font=/APONEK+Webdings> Web Proxies. Web proxies are intermediate hosts through which Web sites are accessed. Web proxies make Web page requests on behalf of users, and they cache copies of retrieved Web pages to make additional accesses to those pages more efficient. Web proxies can also be used to restrict Web access and to add a layer of protection between Web clients and Web servers. Web proxies often keep a record of all URLs accessed through them. - GLYPH<c=31,font=/APONEK+Webdings> Vulnerability Management Software. Vulnerability management software, which includes patch management software and vulnerability assessment software, typically logs the patch installation history and vulnerability status of each host, which includes known vulnerabilities and missing software updates. 5 Vulnerability management software may also record additional information about hosts' configurations. Vulnerability management software typically runs occasionally, not continuously, and is likely to generate large batches of log entries. - GLYPH<c=31,font=/APONEK+Webdings> Authentication Servers. Authentication servers, including directory servers and single sign-on servers, typically log each authentication attempt, including its origin, username, success or failure, and date and time.

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

Before the system security plan can be developed, the information system and the information resident within that system must be categorized based on a FIPS 199 impact analysis. Then a determination can be made as to which systems in the inventory can be logically grouped into major applications or general support systems. The FIPS 199 impact levels must be considered when the system boundaries are drawn and when selecting the initial set of security controls (i.e., control baseline). The baseline security controls can then be tailored based on an assessment of risk and local conditions including organization-specific security requirements, specific threat information, costbenefit analyses, the availability of compensating controls, or special circumstances. Common security controls, which is one of the tailoring considerations, must be identified prior to system security plan preparation in order to identity those controls covered at the agency level, which are not system-specific. These common security controls can then be incorporated into the system security plan by reference. - -Security controls associated with public access information systems must be carefully considered and applied with discretion since some of the security controls from the specified security control baselines (e.g., personnel security controls, identification and authentication controls) may not be applicable to users accessing information systems through public interfaces. 12

12 For example, while the baseline security controls require identification and authentication of organizational personnel who maintain and support information systems that provide public access services, the same controls might not be required for users accessing those systems through public interfaces to obtain publicly available information.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management:

. To support the development of an Enterprise Risk Register, this report describes documentation of various scenarios based on the potential impact of threats and vulnerabilities on enterprise assets.
Documenting the likelihood and impact of various threat events through cybersecurity risk registers integrated into an enterprise risk profile helps to later prioritize and communicate enterprise cybersecurity risk response and monitoring.

Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Digital Identity Guidelines_ Federation and Assertions:

) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.
ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report):

- 1) The civilian agency CSPPs basically conformed with the guidance given by OMB Bulletin 88-16. Many controls to protect sensitive systems were already in place or planned. These controls appeared consistent with identified system functions, environment, and security needs. However, some respondents appeared to have just "checked the boxes," perhaps presenting a falsely optimistic picture. - 2) Many agencies appeared to report on isolated systems rather than all systems subject to the Computer Security Act and OMB Bulletin 88-16. - 3) Agencywide guidance on how to prepare the plans was not clear. There was also some question whether a high level official reviewed the plans. Also unclear is the distribution of agency-level computer security policy and guidance. Further, most plans did not reflect the joint involvement of ADP, computer security, and applications communities in computer security planning. - 4) Significantly, the plans rarely addressed the security concerns on networking, interfaces with other systems, and the use of contractors and their facilities. This may reflect a general confusion about the boundaries and limits of responsibility for a given system. - 5) Many plans equated sensitivity only with privacy or confidentiality, and did not fully address requirements for integrity and availability. - 1) Agency management should ensure that computer security has the highest level of management involvement. This involvement is also important in the computer security planning process. Computer security benefits from the multiple perspectives of and input from agency IRM, computer security, and functional, user, and applications personnel
- 2) Agency management should identify and describe the security needs of their systems which contain sensitive information. - 3) Agency management should recognize the importance of computer security and its required planning.

1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does 2016 NIST_ITL Cybersecurity Program Annual Report provide? (Part 3)

[Assistant]
ld like to thank their ITL colleagues who provided writeups  on  their  2016  project  highlights  and  accomplishments  for  this annual report (their names are mentioned after each project writeup).
The editors would also like to acknowledge Elaine Barker (CSD), Lisa Carnahan (Standards Coordination Office, NIST), Greg Witte and Larry Feldman (G2) for reviewing and providing valuable feedback for this annual report. The editors would also like to acknowledge Kristen Dill of Dill and Company, Inc. for designing the cover and inside layout for this 2016 annual report. <!-- image -->

Any  mention  of  commercial  products  or  organizations  is  for informational  purposes  only;  it  is  not  intended  to  imply  recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the products identified are necessarily the best available for the purpose. <!-- image -->

All names are trademarks or registered trademarks of their respective owners.

2016 NIST_ITL Cybersecurity Program Annual Report